Getting Data In

would like to send logs from Splunk to Qradar?

niha1318
New Member

Hi,

got a requirement to send logs from Splunk to Qradar. I have gone through few splunk docs, but I couldn't get proper idea on how to start with this requirement. I was able to find some info from IBM knowledge center, as per documentation there is a Qradar app for splunk data forwarding. but i am not sure how it will work.

please let me know if anyone have knowledge on this?

Thanks in advance

Tags (1)
0 Karma

FrankVl
Ultra Champion

"we wanted to export previously ingested data from splunk to qradar."

If it is a one off, you could do a search and export the events to csv (use the | fields _raw command to restrict the export to just the raw data).

That can also be automated with a saved search that exports to CSV and I guess also through the REST API.

For more information, see: https://docs.splunk.com/Documentation/Splunk/latest/Search/Exportsearchresults

0 Karma

FrankVl
Ultra Champion

Let's start with what kind of data you want to forward. Do you just want to route a copy of some of the data you ingest into splunk also to qradar? Or do you want to send the result of some search / alert / whatever to QRadar?

0 Karma

niha1318
New Member

Hi,

we have already ingested data into splunk, we got thousand's of hosts for specific IIS logs. but we don't want to send all of them, we particularly want to send 75 hosts to qradar.

0 Karma

FrankVl
Ultra Champion

But do you want to export previously ingested data from Splunk, or do you want to implement a (partial) parallel feed to both platforms?

0 Karma

niha1318
New Member

we wanted to export previously ingested data from splunk to qradar.

Thanks,

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...